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Abstract 

In this paper we present two efficient methods for reconstructing a 
rational number from several residue-modulus pairs, some of which may 
be incorrect. One method is a natural generalization of that presented by 
Wang, Guy and Davenport in [WGD1982| (for reconstructing a rational 
number from correct modular images), and also of an algorithm presented 
in [Abbl99l] for reconstructing an integer value from several residue- 
modulus pairs, some of which may be incorrect. 

1 Introduction 

The problem of intermediate expression swell is well-known in computer algebra, 
but has been greatly mitigated in many cases by the use of modular methods. 
There are two principal techniques: those based on the Chinese Remainder 
Theorem, and those based on Hensel's Lemma. In this paper we consider only 
the former approach. 

Initially modular methods were used in cases where integer values were 
sought {e.g. for computing GCDs of polynomials with integer coefficients); the 
answer was obtained by a direct application of the Chinese Remainder The- 
orem. Then in 1981 Wang presented a method allowing the reconstruction 
of rational numbers Wanl981 from their modular images: the original con- 
text was the computation of partial fraction decompositions. Wang's idea was 
justified in a later paper [WGD1982 which isolated the rational number recon- 
struction algorithm from the earlier paper. More recently, Collins and Encar- 
nacion CoEn l994] corrected a mistake in Wang's paper, and described how to 
obtain an especially efficient implementation. Wang's method presupposes that 
all residue-modulus pairs are correct; consequently, the moduli used must all be 
coprime to the denominator of the rational to be reconstructed. 

A well-known problem of modular methods is that of bad reduction: this 
means that the modular result is not correct for some reason. Sometimes it 
will be obvious when the modular result is bad (and these can be discarded), 
but other times it can be hard to tell. The Continued Fraction Method for the 
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fault-tolerant reconstruction of integer values when some of the modular images 
may be bad was presented in | Abb 1991] . 

In this paper we consider the problem of reconstructing a rational number 
from its modular images allowing for some of the modular images to be erro- 
neous. We combine the corrected version of Wang's algorithm with the Con- 
tinued Fraction Method. Our resulting new FTRR Algorithm (see section @| 
reconstructs rational numbers from several modular images allowing some of 
them to be bad. The FTRR Algorithm contains both old methods as special 
cases: when it is known that all residues are correct we obtain Wang's method 
(as corrected in CoEnl994 ), and if the denominator is restricted to being 1 
then we obtain the original Continued Fraction Method. Finally, we note that 
the correction highlighted in |CoEnl99 4 is a natural and integral part of our 
method. 

Our FTRR Algorithm gives a strong guarantee on its result: if a suitable 
rational exists then it is unique and the algorithm will find it; conversely if 
no valid rational exists then the algorithm says so. However, the uniqueness 
depends on bounds which must be given in input, including an upper bound for 
the number of incorrect residues. Since this information is often not known, we 
present also the HRR Algorithm (see section[5]) — it is a heuristic reconstruction 
technique based on the sample principles as FTRR. This heuristic variant is 
much simpler to apply since it requires only the residue-modulus pairs as input. 
It will find the correct rational provided the correct modular images sufficiently 
outnumber the incorrect ones; if this is not the case then HRR will usually 
return an indication of failure but it may sometimes reconstruct an incorrect 
rational. 

In section [6] we briefly compare our HRR algorithm with the Error Tolerant 
Lifting Algorithm presented in [BDFP2012] which is based on lattice reduction, 
and which serves much the same purpose as HRR. We mention also some combi- 
natorial reconstruction schemes (presented in |Abbl99T] ) which can be readily 
adapted to perform fault tolerant rational reconstruction. 

1.1 Envisaged Setting 

We envisage the computation of one or more rational numbers (e.g. coefficients 
of a polynomial) by Chinese remainder style modular computations where not all 
cases of bad reduction can be detected. If we know upper bounds for numerator 
and denominator, and also for the number of bad residue-modulus pairs then 
we can apply the FTRR algorithm of section [4] Otherwise we apply the HRR 
algorithm of section [5] Naturally, in either case we require that the bad residue- 
modulus pairs are not too common. 

When using FTRR we use the sufficient precondition (inequality to 
decide whether more residue-modulus pairs are needed; when we have enough 
pairs we simply apply the reconstruction algorithm to obtain the answer. 

When using HRR, we envisage that the computation is organized as follows. 
Many modular computations are made iteratively, and every so often an attempt 
is made to reconstruct the sought after rational number(s). If the attempt fails, 
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further iterations are made. If the attempt succeeds then a check is made of 
the "convincing correctness" of the reconstructed rational; if the rational is not 
"convincing" then again further iterations are made. 

The perfect reconstruction algorithm would require only the minimum num- 
ber of residue- modulus pairs (thus not wasting "redundant" iterations), and 
never reconstructs an incorrect rational (thus not wasting time checking "false 
positives"). Our HRR algorithm comes close to having both characteristics. 

2 Notation and Assumptions 

We are trying to reconstruct a rational number, p/q, from many residue-modulus 
pairs: Xi mod rrii for i = 1, 2, . . . , s. For each index i satisfying qxi = p mod rrii 
we say that Xi IS cL good residue and is a good modulus; otherwise, if the 
equivalence does not hold, we call them a bad residue and a bad modulus. 

For simplicity, we assume that the moduli rrii are pairwise coprime: this as- 
sumption should be valid in almost all applications. For clarity of presentation, 
it will be convenient to suppose that the moduli are labelled in increasing order 
so that mi < m-2 < • • • < m s . For our algorithms to work well it is best if the 
moduli are all of roughly similar size; otherwise, in an extreme situation where 
there is one modulus which is larger than the product of all the other moduli, 
if that large modulus is bad then reconstruction cannot succeed. 

We say that a rational p/q is normalized if q > and gcd(p, q) = 1. 
2.1 Continued Fractions 

Here we recall a few facts about continued fractions; proofs and further proper- 
ties may be found in HW1979 , for instance. 

Let then x has a unique representation as a continued fraction: 

x = [ao, 01,02,...] = o H — (1) 

where all a,j S Z and aj > for all j > 0. 

The integers oi, 02, . . . are called partial quotients. If x G Q then there 
are only finitely many partial quotients; otherwise there are infinitely many. 

We define the k-th continued fraction approximant to be the rational 
fk/sk whose continued fraction is [oo, ai, ■ ■ ■ , fflfc]. These approximants give ever 
closer approximations to x, that is the sequence \x — rk/sk \ is strictly decreasing. 
We also have that: 

Ofe^fe-i < r k < (a k + l)r fc _i 
OfcSfc-i < s k < (a k + l)s fe _i 

We recall here Theorem 184 from [HW1979] which will play a crucial role. 

Theorem 2.1 Let x 6 M and - £ Q. If \x — -\ < then ^ appears as a 
continued fraction approximant to x. 
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3 Main Proposition 



Our main proposition provides the key to reconstructing a rational from a single 
residue-modulus pair, X mod M. 



Proposition 3.1 Let X mod M be a residue-modulus pair; so X, M £ Z with 
M > 2. Let P, Q £ N be positive; these are bounds for numerator and denom- 
inator respectively. Suppose there exists a factorization M = M goo( jAfbad £ N 
such that 2PQM^ d < M, and suppose also that there exists a rational p/q G Q 
with \p\ < P and 1 < q < Q which satisfies p = qX mod M goo( \. 
unique, and is given by 

p R 
- = X - M ■ — 
q b 

where |l is the last continued fraction approximant to with denominator < 
QMbad! indeed, § is also the last approximant with denominator < M goo( j/2|p|. 
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We may now apply Theorem 184 from |HW1979] to see that is one of 
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the continued fraction approximants for We now show that ■§ is the last 
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mant coming after ^ will be closer to so it must have denominator greater 



than Af good /2|p| 
The claim that 



X — M ■ -§ follows immediately from equation ([3]) . 
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Corollary 3.2 Let j be the index of the approximant -jr in Provosition VJ. 1\ Let 
M* d = gcd(p — qX, M), and MjJ ad = j-M—- Let Q max be the greatest integer 

° good 

strictly less than 2 \ p \'m* ■ Then the (j + l)-th partial quotient is at least — 1 . 
IfM* ood > 2\p\qM* ad (ma,-x(2\p\,q)M* ad + 2) then the (j + l)-th partial quotient 
is the largest of all. 

Proof 

Observe that M* ood > M goo d and MjJ ad < Mbad regardless of the original 
factorization M = Af goo dMb a d used in the proposition. 

By applying the proposition with P — \p\ and Q = q, and using the fac- 
torization M = M* ood M£ ad we see that S < qM^ ad ; furthermore the (j + l)-th 
approximant has denominator greater than M* ood /2\p\ > QmaxMbad- Thus by 
the final inequality of formula ((2]) the (j + l)-th partial quotient must be at least 



Since S, the denominator of the j-th approximant, is at most qM£ ad no 
partial quotient with index less than or equal to j can exceed qM£ ad . Also, since 
the denominator of the (j + l)-th approximant is greater than M* ood /2\p\ and 
the denominator of the final approximant is at most M, every partial quotient 
with index greater than j + 1 is less than 2\p\M£ ad . 

The hypothesis relating M* ood to M£ ad thus guarantees that the (j + l)-th 
partial quotient is the largest. □ 



Example 

Let X = 7213578109 and M = 101 x 103 x 105 x 107 x 109. Let 
P = Q = 100. By magic we know that Mbad = 101, so we seek 
the last approximant to jg- with denominator at most QAfbad = 
10100. It is the 10-th approximant and has value ^ = 2116/3737. 
Hence the candidate rational is | = X — M ■ ^ = 13/37 which does 
indeed satisfy the numerator and denominator bounds. The next 
approximant has denominator 9701939 > M goo d/2|p|. And the 11- 
th partial quotient is 2596 > ™ — 1 as predicted by the corollary. 

4 The Fault Tolerant Rational Reconstruction 
Algorithm 

We present our first algorithm for reconstructing rational numbers based on 
Proposition [3TTJ The algorithm expects as inputs: 

• a set of residue- modulus pairs {xi mod mi : i = 1, . . . , s}, 

• upper bounds P (for the numerator), and Q (for the denominator) of the 
rational to be reconstructed, 

• an upper bound e for the number of bad residue-modulus pairs. 



5 



We recall that the moduli rrii are coprime, and are ordered so that mi < 
m 2 < ••• < m s . We define M max = m s - e +im s -e+2 • • 4 rn s . So that we can 
apply the proposition we require that 

M = mim 2 ■■■m s > 2PQM% iax (4) 

Comparing this with the condition given in WGD1982] we see that an extra 
factor of M^ ax appears: this is to allow for a loss of information "up to M max " , 
and to allow for an equivalent amount of redundancy requisite for proper recon- 
struction. If the denominator bound Q = 1 then the precondition Q simplifies 
to that for the Continued Fraction Method |Abbl99lj . 

4.1 The FTRR Algorithm 

The main loop of this algorithm is quite similar to that in [WGD1982 : it just 
runs through the continued fraction approximants for X/M , and selects the last 
one with "small denominator" ; there is a simple final computation to produce 
the answer. 

1 Input e, P, Q, and {xi mod m, : i = 1, . . . , s} 

2 If Xi = mod rrii for at least s — e indices i then return 0. 

3 Set M — Y[ m i- Use Chinese remaindering to compute X mod Af from 

Xi mod rrii. 

4 Compute M max = m s - e +im s - e+2 ■ ■ ■ m s . 

5 If gcd(X, M) > PM max then return FAILURE. 

6 Put u = (1,0, M) and v = (0, 1,X). 

7 While \v 2 \ < QM max do 

7.1 q = [u 3 /v 3 \ 

7.2 u = u — qv; swap u < — > v 

8 Set r = X + M ■ — as a normalized rational. 

9 Check whether r is a valid answer: 

i.e. | num(r) < P and den(r) < Q and at most e bad moduli. 

10 If r is valid, return r; otherwise return FAILURE. 

Note that in the algorithm the successive values of — — at the end of each 
iteration around the main loop are just the continued fraction approximants to 
X/M. 

Example For some inputs to algorithm FTRR there is no valid 
answer. If the input parameters are e — 0, P = Q = 1 and x\ = 2 
with modulus m\ — 5 then with the given bounds the only possible 
valid answers are { — 1,0,1} but 2 mod 5 does not correspond to any 
of these. 
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4.2 Correctness of FTRR Algorithm 



We show that FTRR finds the right answer if it exists, and otherwise it produces 
failure. 

We first observe that if the correct result is and at most e residue-modulus 
pairs are faulty then step (2) detects this, and rightly returns 0. We may 
henceforth assume that the correct answer, if it exists, is a non-zero rational 
2 G Q with \p\ < P and 1 < q < Q. 

Lemma 4.1 If there is a valid non-zero solution p/ q then gcd(A, M) < PAf max . 

Proof As the mi are coprime gcd(X, M) = Y[ gcd(xi,mi). If the modulus is 
good then gcd(xi, m,i)\p; conversely if gcd(iEi, ra^fp then m, is a bad modulus. 
Hence JXrngood S^i, rm)\p] while EL.bad gcdfo, m.) < Y[ m . bad mi < M m»- 
It is now immediate that gcd(X, M) < PM max . □ 

From the lemma we deduce that the check in step (5) eliminates only (X, M) 
pairs which do not correspond to a valid answer. We also observe that for all 
(X, M) pairs which pass the check in step (5) the denominator of the normalized 
form of X/M is at least 2QM max , so the loop exit condition in step (7) will 
eventually trigger. 

The values X and M computed in step (3) are precisely the correspond- 
ing values in the statement of Proposition 13.11 However, we do not know the 
correct factorization M = M goot jMb a d; but since there are at most e bad residue- 
modulus pairs we do know that Mbad < Afmax, and this inequality combined 
with the requirement (|4]) together imply that 2PQM? ad < M so we may ap- 
ply the proposition. Thus the algorithm simply has to find the last continued 
fraction approximant |r with denominator not exceeding QM max , which is pre- 
cisely what the main loop does: at the end of each iteration — — and — — are 

successive approximants to and the loop exits when ji^l > QM max . 

So when execution reaches step (8), the fraction — 2i is precisely the ap- 
proximant tt of the proposition. Thus step (8) computes the candidate answer 
in r, and step (9) checks that the numerator and denominator lie below the 
bounds P and Q, and that there are no more than e bad moduli. If the checks 
pass, the result is valid and is returned; otherwise the algorithm reports failure. 

4.3 Which Residues were Faulty? 

Assume the algorithm produced a normalized rational p/q, and we want to 
determine which moduli (if any) were faulty. We could simply check which 
images of p/q modulo each rtii are correct. However, there is another, more 
direct way of identifying the bad moduli: we show that the bad m; are exactly 
those which have a common factor with S, that is the final value of ui- 

If mi is a good modulus then we have gcd(mi,g) = 1 because otherwise if 
the gcd, h, were greater than 1 then p = qxi mod mj implies that h divides p, 
contradicting the assumption that p and q are coprime. 
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Multiplying equation [3] from the proof of Proposition 13.11 by qM we obtain 
p = qX — M ■ whence M ■ ^ is an integer. By definition of a bad modulus mi 
we must have M ■ % ^ mod m r Since m^M, we must have gcd(TO i; S) > 1. 

5 The Heuristic Algorithm 

The main problem with the FTRR Algorithm is that we do not generally know 
good values for the input bounds P, Q and e. In this heuristic variant the only 
inputs are the residue-modulus pairs; the result is either a rational number or an 
indication of failure. The algorithm is heuristic in that it may (rarely) produce 
an incorrect result, though if sufficiently many residue-pairs are input (with 
fewer than ^ of them being bad) then the result will be correct. 

5.1 Algorithm HRR: Heuristic Rational Reconstruction 

1 Input Xi mod m s for i = 1, . . . , s. Set A cr n = 10 6 (see note below). 

2 Put M — Y\mi. Use Chinese remaindering to compute X 6 Z such that 

\X\ < M and X = Xi mod m;. 

3 If gcd(X, M ) 2 > A crlt M then return 0. 

4 Let A max be the largest partial quotient in the continued fraction of X/M. 

If A max < A cr it then return failure. 

5 Put u = (1,0, M) and v = (0,1, X), and set q = 0. 

6 While <? ^ A 

max 

do 

6.1 q = Lw 3 MJ 

6.2 r = u — ; u — v; v = r 

7 Return N/D the normalized form of X + Mu\jui\ we could also return 

Mbad = gcd(M, Ua ). 

The idea behind the algorithm is simply to exploit Corollary 13.21 algorith- 
mically. This corollary tells us that, provided M goo( j is large enough relative to 
■^badj we can reconstruct the correct rational from the last approximant before 
the largest partial quotient. Moreover if the proportion of residue-modulus pairs 
which are bad is less than i then M goo( j will eventually become large enough. 

Since zero requires special handling, there is a special check in step (3) for 
this case. The heuristic will produce zero if "significantly more than half of the 
residues" are zero — strictly this is true only if all the moduli are prime and of 
about the same magnitude. 

To avoid producing too many false positives we demand that the largest 
partial quotient be greater than a certain threshold, namely A cr i t . The greater 
the threshold, the less likely we will get a false positive; but too great a value will 
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delay the final recognition of the correct value. The suggested value A crit = 10 6 
worked well in our trials. 

Alternative criterion for avoiding false positives 

Our implementation in CoCoALib actually uses a slightly different convincing- 
ness criterion in step (4). Let A max be the largest partial quotient, and A next 
the second largest. Our alternative criterion is to report failure if A max /A next is 
smaller than a given threshold — in our trials a threshold value of 4096 worked 
well, but our implementation also lets the user specify a different threshold. 

5.1.1 Complexity of HRR 

Under the natural assumption that each residue satisfies \xi\ < rrii, we see 
that the overall complexity of algorithm HRR is 0((logM) 2 ), the same as 
for Euclid's algorithm. Indeed the Chinese remaindering in step (2) can be 
done with a modular inversion (via Euclid's algorithm) and two products. The 
computation of the partial quotients in step (4) is Euclid's algorithm once again. 
And the main loop in step (6) is just Euclid's algorithm in reverse. 

We note that the overall computational cost depends on how often HRR 
is called in the envisaged lifting loop (see subsection II. ip . Assuming that the 
moduli chosen are all about the same size, a reasonable compromise approach 
is a "geometrical strategy" where HRR is called whenever the number of main 
iterations reaches the next value in a geometrical progression. This compromise 
avoids excessive overlifting and also avoids calling HRR prematurely too often. 
The overall cost of HRR with such a strategy remains 0((logAf) 2 ) where M 
here denotes the combined modulus in the final, successful call to HRR. 

In practice, if the cost of calling HRR is low compared to the cost of one 
modular computation in the main loop then it makes sense to call HRR fre- 
quently. The geometrical strategy should begin only when (if ever) the cost of 
a call to HRR is no longer relatively insignifiant. 

6 Comparison with Other Methods 
6.1 Reconstruction via Lattice Reduction 

A reconstruction technique based on 2-dimensional lattice reduction is presented 
as Algorithm 6 Error Tolerant Lifting (abbr. ETL) in jBDFP2012| . This algo- 
rithm is similar in scope to our HRR, and not really comparable to our FTRR 
algorithm (which needs extra inputs from the user). 

In practice there are two evident differences between ETL and our HRR. The 
first is that ETL produces many more false positives than HRR; our refinement 
(B) below proposes a way to rectify this. The second is that ETL finds balanced 
rationals more easily than unbalanced ones, i.e. it works best if the numerator 
and denominator contain roughly the same number of digits. For balanced 
rationals, ETL and HRR need about the same number of residue-modulus pairs; 
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for unbalanced rationals ETL usually needs noticeably more residue-modulus 
pairs than HRR. 

6.1.1 Practical Refinements to ETL 

We propose two useful refinements to ETL as it is described in |BDFP2012j . 

A We believe that a final checking step should be added to the ETL algo- 
rithm so that it rejects results where half or more of the moduli are bad. 
Consider the following example: the moduli are 11, 13, 15, 17, 19 and the 
corresponding residues are —4, —4, —4, 1,1. The rather surprising result 
produced by ETL is 1; it seems difficult to justify this result as being 
correct. Here we see explicitly the innate tendancy of ETL to favour 
"trusting" larger moduli over smaller ones. 

B The aim of our other refinement is to reduce the number of false positives 
which ETL produces. We suggest replacing their acceptance criterion 
a i+i + < N by a stricter condition such as af, x + 6| +2 < iV/100. This 
change may require one or two more "redundant" residue-modulus pairs 
before ETL finds the correct answer, but it docs indeed eliminate most of 
the false positives. 

6.1.2 Comparison of Efficiency 

We have implemented HRR and ETL in CoCoALib and CoCoA-5. Using these 
implementations we compared the efficiency of HRR and ETL by generating 
a random rational N / D (with a specified number of bits each for the numer- 
ator and denominator), and then generating the modular images Xi mod rrn 
where the nm run through successive primes starting from 1013. Note that in 
this trial there are no bad residue-modulus pairs. We then counted how many 
residue-modulus pairs were needed by the algorithms before they were able to 
reconstruct the original rational. 

We then repeated the experiment but this time, with probability 10%, each 
residue was replaced by a random value to simulate the presence of bad residues. 
As expected, the number of residue- modulus pairs increased by about 25%. 

Observe that the number of pairs needed by HRR is essentially constant, 
while ETL matches the efficiency of HRR only for perfectly balanced rationals; 
as soon as there is any disparity between the sizes of numerator and denominator 
ETL becomes significantly less efficient. 

In each case the successful reconstruction took less than 0.1 seconds. 
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6.2 Combinatorial Methods 



It is shown in |Stol963] that reconstruction of integers by Chinese Remaindering 
is possible provided no more than half of the redundant residues are faulty. The 
correct value is identified using a voting system (see |Stol963] for details). We 
can extend the idea of a voting system to allow it to perform fault tolerant 
rational reconstruction: the only difference is that for each subset of residue- 
modulus pairs we effect an exact rational reconstruction (rather than an exact 
integer reconstruction). However the problem of poor computational efficiency 
remains. 

An elegant and efficient scheme for fault-tolerant Chinese remaindering for 
integers was given in [Rami 983] ; however the method is valid only for at most 
one bad modulus. Several generalizations of Ramachandran's scheme were given 
in |Abbl99l] ; however, these are practical really only for at most 2 bad moduli. 
Like the voting system, these schemes could be easily adapted to perform fault- 
tolerant rational reconstruction, but in the end the Continued Fraction Method 
(upon which FTRR is based) is more flexible and more efficient. 

7 Conclusion 

We have presented two new algorithms for solving the problem of fault tolerant 
rational reconstruction, FTRR and HRR. The former is a natural generaliza- 
tion both of the original rational reconstruction algorithm WGD1982 and of 
the fault tolerant integer reconstruction algorithm [Abb 1991]. The latter is a 
heuristic variant which is easier to use in practice since it does not require certain 
bounds as input. 

Our HRR algorithm and the ETL algorithm from [BDFP2012^ offer two quite 
distinct (yet simple) approaches to the same problem. They have comparable 
practical efficiency when reconstructing balanced rationals, whereas HRR is 
usefully more efficient when reconstructing unbalanced rationals. 
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